CVE-2023-45229: Tianocore EDK2 Information Disclosure Flaw

CVE-2023-45229 Overview

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability, part of the broader "PixieFail" vulnerability collection affecting UEFI network implementations, can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

The vulnerability exists in the UEFI firmware's handling of DHCPv6 network boot operations. When a malicious DHCPv6 server sends a crafted Advertise message with specially constructed IA_NA (Identity Association for Non-temporary Addresses) or IA_TA (Identity Association for Temporary Addresses) options, the EDK2 network stack fails to properly validate bounds before reading memory, allowing attackers on the adjacent network to read sensitive data from UEFI memory.

Critical Impact

Attackers on the local network can exploit this out-of-bounds read vulnerability to potentially extract sensitive information from UEFI firmware memory during network boot operations, compromising system confidentiality before the operating system loads.

Affected Products

• Tianocore EDK2 (all versions prior to security patch)
• Systems using EDK2-based UEFI firmware with network boot enabled
• Enterprise and server systems utilizing PXE boot infrastructure

Discovery Timeline

• 2024-01-16 - CVE CVE-2023-45229 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-45229

Vulnerability Analysis

This out-of-bounds read vulnerability exists in the DHCPv6 protocol implementation within EDK2's Network Package. The flaw occurs during the parsing of DHCPv6 Advertise messages, specifically when handling the IA_NA and IA_TA options which are used for IPv6 address assignment.

The vulnerability can be exploited from an adjacent network position, requiring no authentication or user interaction. While the attack complexity is low, the attacker must have access to the local network segment where the target system is performing DHCPv6 operations. The exploitation results in high confidentiality impact, potentially exposing sensitive data stored in UEFI memory, though it does not directly affect system integrity or availability.

This vulnerability is part of the "PixieFail" family of vulnerabilities affecting UEFI network boot implementations, which collectively expose critical firmware-level security weaknesses in enterprise boot infrastructure.

Root Cause

The root cause of CVE-2023-45229 is improper bounds checking in the DHCPv6 option parsing code within EDK2's Network Package. When the firmware receives a DHCPv6 Advertise message, it processes the embedded options without adequately validating that the specified option lengths and data offsets fall within the bounds of the received packet buffer.

The IA_NA and IA_TA options contain sub-options and length fields that, when maliciously crafted, can cause the parser to read beyond the allocated buffer boundaries. This CWE-125 (Out-of-bounds Read) condition occurs because the code trusts attacker-controlled length values without proper sanitization.

Attack Vector

The attack vector requires adjacent network access, meaning the attacker must be positioned on the same network segment as the target system. The attack scenario typically involves:

1. The attacker positions themselves on the local network where UEFI PXE boot operations occur
2. The attacker sets up a malicious DHCPv6 server or intercepts DHCPv6 traffic
3. When a target system initiates network boot and sends a DHCPv6 Solicit message, the attacker responds with a crafted Advertise message
4. The malicious message contains IA_NA or IA_TA options with manipulated length fields designed to trigger the out-of-bounds read
5. The UEFI firmware processes the malicious options, reading memory beyond the intended buffer boundaries
6. The attacker can potentially receive the leaked memory contents in subsequent protocol exchanges

The vulnerability is particularly concerning in enterprise environments where network boot is commonly used for system deployment and recovery operations. Detailed technical analysis and proof-of-concept materials are available through the Packet Storm PixieFail PoCs and the CERT Vulnerability Report.

Detection Methods for CVE-2023-45229

Indicators of Compromise

• Unusual DHCPv6 traffic patterns on network segments with PXE boot infrastructure
• Malformed DHCPv6 Advertise messages with abnormally large or invalid IA_NA/IA_TA option lengths
• Unexpected DHCPv6 servers appearing on network segments designated for network boot operations
• Systems experiencing boot failures or crashes during DHCPv6 network boot sequences

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with rules to identify malformed DHCPv6 packets targeting IA_NA and IA_TA option parsing
• Monitor DHCPv6 traffic for anomalous option lengths that exceed expected values or packet boundaries
• Implement DHCPv6 snooping and DHCP guard features on network switches to prevent rogue DHCPv6 server attacks
• Utilize SentinelOne's network visibility capabilities to detect suspicious DHCPv6 activity patterns

Monitoring Recommendations

• Enable detailed logging on DHCPv6 servers and relay agents to capture option-level details of client-server exchanges
• Monitor network boot infrastructure for unauthorized DHCPv6 server advertisements using 802.1X or similar network access controls
• Implement network segmentation to isolate PXE boot traffic and limit the attack surface for adjacent network exploitation
• Review firmware boot logs for error conditions that may indicate attempted exploitation

How to Mitigate CVE-2023-45229

Immediate Actions Required

• Update EDK2-based firmware to the latest patched version from your system vendor
• Disable IPv6 network boot if not required for operations until patches can be applied
• Implement strict network segmentation to isolate PXE boot infrastructure from untrusted network segments
• Enable DHCPv6 guard and RA guard features on network switches to prevent rogue server attacks

Patch Information

Tianocore has released security patches addressing this vulnerability. Organizations should consult the GitHub Security Advisory GHSA-hc6x-cw6p-gj7h for official patch information. System vendors incorporating EDK2 should be contacted for firmware updates specific to your hardware platform.

Additional vendor-specific advisories are available from NetApp and through the Debian LTS announcement for systems using OVMF packages.

Workarounds

• Disable DHCPv6 and IPv6 network boot in UEFI/BIOS settings if IPv6 PXE boot is not operationally required
• Implement network access control to ensure only authorized systems can access PXE boot network segments
• Deploy DHCPv6 snooping on network switches to validate DHCPv6 server responses
• Use static IPv6 addressing instead of DHCPv6 where feasible to eliminate the attack vector

# Network switch configuration example for DHCPv6 guard (Cisco IOS syntax)
ipv6 dhcp guard policy DHCP_GUARD_POLICY
  device-role client
  trusted-port

interface GigabitEthernet0/1
  ipv6 dhcp guard attach-policy DHCP_GUARD_POLICY